How to turn on device encryption on a Windows 11 Home PC
Windows 11 Home doesn't include BitLocker, the full disk-encryption tool that comes with Windows 11 Pro. It does include a cut-down version called Device encryption, which scrambles everything on the PC's internal drives so the files can't be read by someone who takes the drive out or boots the PC from a USB stick. It's one switch in Settings. This guide covers that switch, the Microsoft account it depends on, and where Windows puts the recovery key you'll need if the PC ever refuses to start.
What you'll need: A PC running Windows 11 Home, signed in with an administrator account. A Microsoft account to sign in with, because that's where Windows saves the recovery key. Most PCs sold with Windows 11 already meet the hardware requirements (a TPM chip and Secure Boot turned on); if yours doesn't, the switch won't appear in Settings at all. See Troubleshooting.
Open Settings
Hold down the Windows key and press I. The Settings window opens.
Click Privacy & security
In the list down the left-hand side of the Settings window, click Privacy & security. If the window is too narrow to show the list, click the three-line menu icon at the top-left first.
Click Device encryption
The first section on the page is headed Security. Click Device encryption. It sits below Windows Security and Find my device.
Switch Device encryption on
Click the switch next to Device encryption so it reads On. Encryption starts in the background. You can carry on using the PC while it runs, and it picks up where it left off if you shut down part-way through.
If the switch is already On, the PC was encrypted when it was set up. Many manufacturers do this before the PC leaves the factory, and Windows 11 version 24H2 does it on a clean install when you sign in with a Microsoft account. Go to step 5 to make sure the recovery key is saved.
Check for a warning about your Microsoft account
Look at the Device encryption page after switching it on. If you're signed in to Windows with a local account, a yellow warning appears reading Sign in with your Microsoft account to finish encrypting this device. Until you do, the drive isn't properly protected, because Windows won't finish the job without somewhere to save the recovery key.
Click the sign-in link in that message and follow the prompts to switch your Windows account to a Microsoft account. If there's no warning, your account is already a Microsoft account and you can move on.
Confirm the recovery key has been saved
The recovery key is a 48-digit number. Windows asks for it if the PC ever fails to recognise its own hardware, which can happen after a firmware update, a motherboard repair or a change to the UEFI settings. Without it, an encrypted drive stays locked for good.
Open a browser, go to the address below, and sign in with the same Microsoft account you use on the PC. You should see your PC's name listed, with a Key ID and a Recovery key next to it.
https://account.microsoft.com/devices/recoverykeyCheck the drive shows as encrypted
Open File Explorer and click This PC in the left-hand pane. Once encryption has finished, the icon for Windows (C:) gains a small padlock. An open padlock means the drive is encrypted and unlocked for the current session, which is what you'll see whenever you're signed in.
Full encryption of a large drive takes a while, so the padlock may not appear straight away. The switch in Settings stays On throughout.
Variations
Click Start, type the name below, then right-click System Information in the results and choose Run as administrator.
msinfo32With System Summary selected on the left, scroll to the bottom of the right-hand pane and find the line Device Encryption Support. If it reads Meets prerequisites, the switch will be available. Otherwise it lists the reasons it isn't, which usually point at the TPM or Secure Boot being turned off in the PC's UEFI settings.
Go back to Settings › Privacy & security › Device encryption and click the switch so it reads Off. Windows asks you to confirm, then decrypts the drive in the background. This takes about as long as encrypting it did. Your files are readable throughout.
Device encryption only covers the PC's internal drives. Encrypting a removable drive needs BitLocker To Go, which is part of the full BitLocker feature in Windows 11 Pro. On Home, the option isn't there, and upgrading to Pro through the Microsoft Store is the supported way to get it. A free alternative is VeraCrypt, which works on any edition but is a separate program with its own learning curve.
Troubleshooting
First check you're signed in as an administrator: go to Settings › Accounts › Your info and look for the word Administrator under your name. If you are, run the System Information check under Variations. The most common failures are the TPM being disabled or Secure Boot being off, both of which are changed in the PC's UEFI settings rather than in Windows. Older third-party guides also list "Modern Standby" or "HSTI" as requirements; Microsoft dropped both in Windows 11 version 24H2, so if your PC is up to date those reasons no longer apply.
Windows has prepared the drive but hasn't finished protecting it, because there's no Microsoft account to hold the recovery key. Switching your sign-in to a Microsoft account (step 5) clears the warning. If you've already done that and it still shows, sign out of Windows and back in, then check the recovery key page from step 6. Once a key is listed there, the warning should have gone.
This is the encryption doing its job after something about the PC changed: a UEFI or firmware update, a new motherboard, a changed boot order, or a docking station the PC didn't expect. On any other device, go to the recovery key page from step 6, sign in with your Microsoft account, and find the entry whose Key ID matches the first few characters shown on the PC's screen. Type the 48-digit key in and Windows starts normally. It usually won't ask again until something else changes.
Need a calculator rather than a guide? Try Simplicalcs →